AI 安全

模型安全、資安、隱私、供應鏈、紅隊與防護。

Even a Frozen Qwen3-8B Shows “Capability Expansion,” Prompting Researchers to Call for Empirical Null Baselines in Self-Improvement Evaluations

New research finds that single-run greedy decoding and unstable thresholds can make a completely untrained model appear to gain or lose capabilities. After switching to exact per-item tests, three forms of self-training only consistently strengthened existing capabilities, with no evidence that they acquired new capabilities never demonstrated by the base model.

2026-08-21

代理工具

Slack Code Brings Coding Agents into Shared Channels, With Diff Views, Live Previews, and Human Approval

Salesforce has launched Slack Code, allowing teams to create project-specific Code Channels directly from conversations and collaboratively monitor, revise, and approve agent-generated code. Initial integrations include Claude, Devin, GitHub Copilot, ChatGPT, and Vercel agents, but details about security isolation, permission granularity, and APIs have yet to be fully disclosed.

2026-08-21

Attacking VLMs by Backpropagating Through the Vision Encoder Alone Cuts H100 Generation Time From Over 20 Minutes to About 100 Seconds

New research avoids backpropagating through the full multimodal model, instead modifying the input image so that the vision encoder’s representation diverges from the original image or approaches a specified target. Untargeted attack success rates exceeded 93% across four open VLMs, but the evaluation relies on a single LLM judge and does not test black-box transferability.

2026-08-20

AI 安全

VLA Monitors Hidden-State Communication Between Agents, Achieving 0.993 AUROC in Same-Model Auction Tests

A new study links continuous vectors exchanged between agents—but omitted from conversation logs—to their subsequent public actions as a single event, then applies three layers of checks: anomaly detection, counterfactual impact analysis, and sparse-feature inspection. The average AUROC of 0.993 combines text-based and latent-collusion samples, and the attacks were predesigned by the researchers, so the result cannot yet be considered a general capability for detecting emergent conspiracies.

2026-08-20

AI 安全

PACE Binds AI Agent Transaction Approvals to Onchain Bytes, Cutting the Unsafe Execution Rate From 0.80 to Zero in Sandbox Tests

PACE does not ask language models to determine whether transactions are safe. Instead, it uses deterministic rules to check transaction intent, simulation results, and actual calldata. A smart account revalidates the signed policy decision record before execution, though the zero-failure result so far comes only from a simplified DeFi sandbox.

2026-08-19

AI 安全

Two-Agent Debate Curbs Reward Hacking in RLAIF, Raising Peak Math Policy Accuracy from 72.63% to 74.74%

Google DeepMind researchers had the same Gemini policy play both solver and critic, with a weaker frozen model serving as judge. Debate preserved the judge’s discriminative ability and recovered about 45% of the gap to RLVR, at the cost of more training steps and constrained critique length.

2026-08-19

AI 安全

Medical LLMs Give Self-Care Advice Before Patients Respond; a Short Instruction Cuts the Rate from 9/12 to 0/12

A new study moves evaluation upstream to the initial-contact stage, before patients have clearly described their problems. Adding a “clarify first, advise later” system instruction improved response sequencing and handoff summaries, but still did not reliably elicit decisive medical history.

2026-08-19

代理工具

AeroCopilotBench Turns Flight Procedures Into Executable State Machines, Yet the Best Agent’s Safe Pass Rate Is Still Only 72.6%

The new benchmark uses 73 abnormal cockpit tasks to test whether agents can observe state, operate systems, and comply with hard safety constraints throughout—not merely answer aviation knowledge questions. GPT-5.6 Sol achieved the highest success rate, but similar knowledge scores did not correspond to similar task success rates, showing that static question answering cannot replace interactive safety testing.

2026-08-19

代理工具

Reconstruction Hides Papers and Provides Only Older References; Multi-Model Review Raises Research-Idea Match Rate from 14.6% to 35.6%

A new benchmark asks models to reconstruct a hidden paper’s core research idea using only references that existed before its publication. Cross-review by four models and Swiss-system selection improve the match rate, but the candidate count, judge pool, and compute budget are not aligned with the single-model setting.

2026-08-19

AI 安全

Model Hypnosis Stacks Irrelevant Textual Cues to Dramatically Flip a Reasoning Model’s Binary Answer Probabilities

A new study uses an additive log-odds model to measure subtle biases introduced by paraphrases, typos, animal names, and JSON fields, then combines cues that push in the same direction into a prompt. Some optimized prompts transfer across models, though the current experiments focus on artificially designed binary-choice questions.

2026-08-18

AI 安全

CompoSkill Shows Agent Skills That Pass Individual Scans Can Still Form Risk Chains at Rates of Up to 80% When Composed

CompoSkill reframes skill security from evaluating individual packages to analyzing paths involving cross-skill data flows and side effects. Across its 1,140 test cases, the highest risk-chain formation rates for white-box and black-box attacks reached 83.3% and 80.6%, respectively, but these figures are not equivalent to real-world compromise success rates.

2026-08-18

AI 安全

Compliance Detectors Still Mostly Read the Scenario Even When Given Rules; Cross-Rule Tests Fall Nearly to Chance

A new study finds that several guard models and activation probes show almost no change in judgment accuracy when rules are removed, shuffled, or replaced. In cross-rule tests designed to eliminate textual shortcuts, fast detectors perform near chance; only models using step-by-step reasoning clearly recover the ability to combine rules with scenarios.

2026-08-18